Banking Law and SWIFT Regulatory Issues in Spain — Detailed Explanation with Case Laws

1. Introduction

SWIFT — the Society for Worldwide Interbank Financial Telecommunication — provides the secure messaging infrastructure used by banks and financial institutions to exchange payment instructions and other financial information. SWIFT itself generally does not execute or settle the payment; it transmits standardized financial messages between institutions.

For Spanish banks, SWIFT activity is regulated through a combination of:

• Spanish banking and payment-services law;
• EU banking regulation;
• anti-money laundering and counter-terrorist-financing rules;
• EU sanctions law;
• GDPR and Spanish data-protection law;
• operational and ICT-risk requirements under DORA;
• ECB and Banco de España supervisory requirements; and
• rules concerning cross-border transfers of financial information.

A particularly important issue is that SWIFT transactions can involve the movement of customer and transaction information across jurisdictions, creating privacy, sanctions, AML, cybersecurity and supervisory concerns.

2. SWIFT and Spanish Banks

Spanish banks commonly use SWIFT messaging for:

• international transfers;
• correspondent banking;
• trade finance;
• securities transactions;
• foreign-exchange transactions;
• interbank payments; and
• communication with financial institutions outside Spain.

A Spanish bank using SWIFT must therefore ensure that its internal systems can identify suspicious transactions, comply with sanctions and maintain adequate records.

SWIFT compliance is not simply a technical IT matter. It can create legal and regulatory responsibilities for the bank.

3. Anti-Money Laundering and SWIFT

Spain's principal AML framework is based on Law 10/2010 on the prevention of money laundering and terrorist financing, together with EU AML legislation.

Banks must conduct:

• customer identification;
• beneficial-owner identification;
• customer-risk assessment;
• transaction monitoring;
• enhanced due diligence for high-risk relationships;
• suspicious-transaction reporting; and
• appropriate record keeping.

SWIFT messages can contain information useful for AML monitoring, such as:

• ordering customer;
• beneficiary;
• correspondent bank;
• country of origin;
• destination;
• transaction amount; and
• payment purpose.

A Spanish bank cannot treat SWIFT as a substitute for its own AML controls. The bank remains responsible for having an effective compliance framework.

4. EU Sanctions and SWIFT

Another major regulatory issue is financial sanctions.

Spanish banks must comply with directly applicable EU sanctions regulations. Where a person, company, bank or jurisdiction is subject to sanctions, the bank may have to:

• reject a transaction;
• freeze assets;
• prevent access to funds;
• conduct sanctions screening; or
• report relevant activity to competent authorities.

SWIFT messaging creates an important distinction between transmitting a financial message and actually executing a payment.

A bank therefore needs controls capable of screening SWIFT messages before allowing the underlying transaction to proceed.

5. SWIFT and Data Protection

SWIFT messages may contain personal information. Examples include:

• names;
• bank-account information;
• addresses;
• transaction details;
• payment references; and
• information identifying businesses or individuals.

The GDPR therefore becomes relevant.

Spanish banks must have a lawful basis for processing personal data, comply with data-minimisation requirements and apply appropriate security measures.

The difficulty becomes greater when information connected with a SWIFT transaction is transferred or made accessible outside the European Economic Area.

Cross-border access can trigger GDPR requirements concerning international data transfers.

6. SWIFT and the United States — TFTP Issue

One of the most important historical regulatory controversies involving SWIFT concerned access by the US Treasury Department to financial messaging information for counter-terrorism purposes.

The EU and United States eventually established the EU-US Terrorist Finance Tracking Program (TFTP) Agreement.

The issue created a difficult legal balance:

How can governments obtain financial information needed for counter-terrorism while protecting European privacy and data-protection rights?

This question is particularly important for Spanish banks because SWIFT transactions may involve EU and non-EU financial institutions.

7. SWIFT and Cybersecurity

Cybersecurity is now one of the most important SWIFT-related banking risks.

Spanish banks must protect SWIFT-connected systems against:

• unauthorized access;
• malware;
• credential theft;
• fraudulent payment instructions;
• insider threats;
• system manipulation;
• business-email compromise; and
• operational disruption.

The Digital Operational Resilience Act (DORA) has substantially strengthened EU requirements for financial-sector ICT risk management.

Under DORA, financial institutions must establish appropriate:

• ICT risk-management frameworks;
• incident-management procedures;
• testing programmes;
• business-continuity arrangements;
• third-party risk controls; and
• reporting mechanisms.

Therefore, a Spanish bank's SWIFT environment should form part of its wider operational-resilience framework.

8. SWIFT and Outsourcing / Third-Party Risk

Banks may depend on:

• SWIFT infrastructure;
• telecommunications providers;
• cloud providers;
• cybersecurity companies;
• correspondent banks; and
• other technology suppliers.

This creates third-party risk.

Spanish banks must therefore understand:

1. who has access to SWIFT-related systems;
2. where data is processed;
3. how access is controlled;
4. what happens during a system failure;
5. how incidents are reported; and
6. whether critical outsourcing arrangements satisfy DORA and supervisory requirements.

The bank cannot simply transfer its regulatory responsibility to a technology provider.

9. Supervisory Role of Banco de España and ECB

Significant Spanish banks fall within the Single Supervisory Mechanism (SSM) and are primarily supervised by the ECB, while Banco de España has important supervisory responsibilities, particularly for less significant institutions and within the broader Spanish framework.

Supervisors can examine whether banks have:

• adequate internal controls;
• appropriate AML systems;
• effective sanctions screening;
• cybersecurity controls;
• operational resilience;
• appropriate governance; and
• reliable payment-processing arrangements.

SWIFT-related weaknesses can therefore become part of a wider prudential and operational-risk assessment.

10. Important Case Laws

Case 1 — Joined Cases C-317/04 and C-318/04, Parliament v Council and Commission (2006)

This was an important early SWIFT-related case.

The European Parliament challenged arrangements concerning the transfer of SWIFT financial-messaging data to the United States.

The Court of Justice annulled the relevant Council decision because of the incorrect legal basis used to conclude the agreement.

Importance for Spain

The case demonstrated that international access to banking information must have an appropriate legal foundation. Spanish banks therefore operate within a framework in which cross-border financial-data transfers cannot simply be justified by administrative convenience.

Case 2 — Case C-28/08, Parliament v Council (2010)

This case concerned the proposed EU-US agreement dealing with the transfer and processing of SWIFT financial-messaging data for counter-terrorism purposes.

The Court again annulled the Council decision because the agreement had been adopted using an inappropriate legal basis.

Importance

The case reinforced the importance of institutional legality, parliamentary involvement and data-protection safeguards when financial information is transferred internationally.

Case 3 — Case C-362/14, Schrems v Data Protection Commissioner (2015)

The CJEU invalidated the EU-US Safe Harbour framework.

The Court stressed that transfers of EU personal data to third countries require adequate protection and effective safeguards.

SWIFT relevance

A Spanish bank cannot assume that transferring customer information outside the EU is lawful merely because the receiving organisation is located in a major financial jurisdiction.

Case 4 — Case C-311/18, Data Protection Commissioner v Facebook Ireland and Schrems (2020)

Known as Schrems II, this judgment invalidated the EU-US Privacy Shield.

The Court emphasized the need to examine whether third-country laws and practices provide adequate protection for EU personal data.

Importance for SWIFT

Where SWIFT-related personal data is transferred internationally, Spanish banks must consider the applicable GDPR transfer mechanism and whether additional safeguards are necessary.

Case 5 — Joined Cases C-293/12 and C-594/12, Digital Rights Ireland (2014)

The CJEU invalidated the EU Data Retention Directive because the broad retention requirements interfered disproportionately with fundamental rights.

Importance

The case illustrates that financial and communications data cannot be retained or accessed without appropriate legal justification and proportionality.

For Spanish banks, record-retention obligations must therefore be reconciled with data-protection and fundamental-rights principles.

Case 6 — Case C-817/19, Ligue des droits humains (2022)

The CJEU examined extensive processing and transfer of passenger information and emphasized the need for safeguards where large quantities of personal information are processed for security purposes.

SWIFT relevance

Although this was not a SWIFT case, its principles are relevant to large-scale financial-data processing: authorities and financial institutions must respect necessity, proportionality, purpose limitation and fundamental rights.

11. Main Regulatory Risks for Spanish Banks

12. Regulatory Enforcement Risk

Failure to maintain effective SWIFT controls can expose a Spanish bank to several types of consequences:

• administrative penalties;
• AML enforcement;
• sanctions-related enforcement;
• GDPR penalties;
• supervisory remediation;
• restrictions on activities;
• civil claims from customers; and
• reputational damage.

The seriousness of the consequences depends on the nature of the violation, its duration, the number of customers affected and whether the bank had adequate compliance systems.

13. Conclusion

SWIFT regulation in Spain is not governed by one single “SWIFT Banking Law.” Instead, SWIFT activity sits at the intersection of Spanish banking law, EU financial regulation, AML rules, sanctions, GDPR, cybersecurity and operational-resilience regulation.

The most important legal principles are:

1. International payment messaging must operate within a lawful regulatory framework.
2. SWIFT information can constitute protected personal data.
3. Cross-border transfers require appropriate GDPR safeguards.
4. Banks must independently conduct AML and sanctions controls.
5. Cybersecurity and SWIFT operational resilience are increasingly important under DORA.
6. Spanish banks remain responsible for their regulatory compliance even where technology or payment infrastructure is provided by third parties.
7. The CJEU's SWIFT, Schrems and fundamental-rights cases show that financial-security objectives must be balanced against legality, proportionality and data-protection rights.

Overall, for Spanish banking institutions, SWIFT should be treated as a critical component of international payment infrastructure requiring strong legal, compliance, cybersecurity and governance controls, rather than merely as a messaging service.